CCNA AI and Network Operations Practice Test 11 — 15 Questions

Question 1

A network administrator at a large enterprise notices that the network monitoring system frequently generates false positive alerts for unusual traffic patterns during normal business hours. The administrator wants to reduce these false positives while still detecting genuine security threats. Which AI/ML concept would best address this requirement?

Accepted Answer

Implement an anomaly detection system that uses machine learning to establish baseline behavior and flag deviations.. Option B is correct because anomaly detection using machine learning establishes a dynamic baseline of normal network behavior, allowing the system to flag only significant deviations. This reduces false positives during normal business hours while still detecting genuine threats that deviate from the learned baseline, unlike static thresholds that trigger alerts on routine traffic variations.

Answer

Deploy a predictive analytics model to forecast future traffic volumes and adjust thresholds accordingly.

Answer

Apply intent-based networking to automatically enforce security policies based on high-level business intent.

Answer

Use deep packet inspection to examine all traffic and create static rules for known threats.

Question 2

A network engineer at a large enterprise observes repeated spikes in latency on the core network every weekday at 10:00 AM, but no corresponding increase in overall bandwidth utilization. The engineer wants to use AI/ML to automatically identify the root cause and take corrective action without manual intervention. Which concept best describes this approach?

Accepted Answer

Intent-based networking. Intent-based networking (IBN) is correct because it describes a closed-loop system where the network continuously validates that its operational state matches the desired business intent. In this scenario, the engineer wants the network to automatically detect the latency anomaly, correlate it with other telemetry (e.g., routing changes, queue drops), and take corrective action (e.g., reroute traffic, adjust QoS) without human intervention — which is the core promise of IBN, often implemented via Cisco's DNA Center with Assurance and AI/ML capabilities.

Answer

Anomaly detection

Answer

Predictive analytics

Answer

Machine learning classification

Question 3

Which TWO of the following are core applications of AI and ML in network operations as described in CCNA 200-301 v2.0 objective 5.1?

Accepted Answer

Using machine learning to detect unusual traffic patterns that may indicate a security threat or network fault.. Options A and D are correct as per CCNA 200-301 v2.0 objective 5.1, which specifically lists anomaly detection using machine learning and intent-based networking as core AI/ML applications in network operations. Option A describes anomaly detection, where ML models trained on baseline traffic identify deviations indicating security threats or faults. Option D describes intent-based networking, where high-level business intent is translated into network policies with continuous verification. Option B (capacity forecasting) and Option C (NLP-based config generation) are not listed in objective 5.1, though they are related AI/ML uses in networking. Option E (reinforcement learning for routing optimization) is also not a core application covered in the CCNA syllabus.

Answer

Using historical data and ML models to forecast future network traffic loads and capacity requirements.

Answer

Automatically generating network configuration scripts using natural language processing.

Answer

Using reinforcement learning to optimize routing protocol metrics in real time.

Question 4

Which TWO statements accurately describe how AI and ML concepts are applied to network operations?

Accepted Answer

Intent-based networking translates business intent into network policies and continuously validates that the network meets those intentions.. Option A is correct because intent-based networking (IBN) captures business intent in a declarative model, translates it into network policies (e.g., via Cisco DNA Center), and continuously validates that the network state matches the intended outcome using assurance and closed-loop analytics. Option B is correct because anomaly detection leverages ML models to establish a baseline of normal traffic and then flags deviations, which can indicate security threats or performance issues. Option C is incorrect because predictive analytics forecasts future network conditions but does not automatically reconfigure devices; that requires closed-loop automation. Option D is false because ML models in network operations are not trained exclusively on labeled data; unsupervised learning can detect unknown patterns without labeled datasets. Option E is false because rule-based systems cannot adapt to new, unknown patterns without manual updates, whereas ML models are better suited for anomaly detection due to their ability to learn and generalize from data.

Answer

Predictive analytics uses historical data to forecast future network conditions and automatically reconfigures network devices to prevent issues.

Answer

ML models in network operations are trained exclusively on labeled datasets to detect known attack signatures.

Answer

Rule-based systems are preferred over ML for anomaly detection because they can adapt to new, unknown patterns without manual updates.

Question 5

Drag and drop the AI/ML concepts on the left to the correct descriptions on the right.

Accepted Answer

Machine Learning: A subset of AI where systems learn from data without explicit programming.. These pairs correctly match fundamental AI/ML concepts with their definitions, as commonly tested in Cisco/IT certifications.

Answer

Deep Learning: A type of AI that uses neural networks with multiple layers to model complex patterns.

Answer

Neural Network: A model that mimics the human brain's structure, used in deep learning.

Answer

Artificial Intelligence: The simulation of human intelligence by machines, including learning and problem-solving.

Question 6

Drag and drop the AI/ML concepts on the left to the correct descriptions on the right.

Accepted Answer

Anomaly detection: Identifies deviations from normal network behavior, such as unusual traffic spikes or security threats.. Supervised learning uses labeled data, unsupervised finds hidden patterns, reinforcement learning uses rewards, neural networks mimic brain structure, training data is for learning, and inference is applying the model to new data.

Question 7

A network operations team is implementing an AI-driven automation system that uses an agentic AI agent to handle routine network issues. The agent is configured to detect high CPU utilization on a core router, then automatically execute a series of diagnostic commands and, if a specific pattern is found, trigger a configuration change to reduce load. After the change, the agent re-checks CPU utilization and, if still high, escalates the issue to a human engineer. Which of the following best describes the workflow being used?

Accepted Answer

A closed-loop remediation workflow. The scenario describes a closed-loop remediation workflow, where the AI agent detects an issue, takes action, verifies the result, and escalates if the problem persists. Tool-calling refers to the agent's ability to invoke specific functions (e.g., diagnostic commands, configuration changes), but the overall process is a closed loop. AI agents are the autonomous entities, but the workflow is the key concept.

Answer

A static automation script that runs on a schedule without feedback

Answer

A tool-calling mechanism for executing network commands

Answer

An AI agent that uses reinforcement learning to optimize network performance

Question 8

A network operations team is implementing an automated system to detect and remediate interface flapping on core switches. The system must be able to query the network device for interface status and execute commands to disable or reconfigure the interface if a pattern of flapping is detected. Which protocol or technology enables the system to programmatically interact with the network device for both monitoring and configuration changes?

Accepted Answer

NETCONF. NETCONF is the correct choice because it is a standardized network configuration protocol that allows automated systems to retrieve operational data and push configuration changes securely. In this scenario, the system would use NETCONF to query interface status and then apply remediation configurations. SNMP can monitor but has limited configuration capabilities, CLI scripting is non-programmatic and error-prone, and Syslog is only for logging.

Answer

SNMP

Answer

CLI scripting

Answer

Syslog

Question 9

Which THREE of the following best describe how agentic AI is used in network automation, specifically regarding AI agents, tool-calling, and closed-loop remediation workflows?

Accepted Answer

AI agents can autonomously decide which network troubleshooting steps to perform and invoke appropriate tools via APIs.. Options A, C, and D are correct because agentic AI in network automation involves autonomous decision-making (A), tool-calling to execute network commands or gather data (C), and closed-loop remediation that continuously monitors, diagnoses, and applies fixes automatically (D). Options B and E are incorrect because they contradict the autonomous nature of agentic AI: B describes a passive monitoring system with human-only remediation, and E states that closed-loop remediation always requires human approval, which is not true for full closed-loop automation.

Answer

AI agents only monitor network traffic and alert humans for any remediation actions.

Answer

Closed-loop remediation always requires a human to approve each corrective action before it is executed.

Question 10

Which THREE statements accurately describe the role of AI agents in closed-loop remediation workflows for network automation?

Accepted Answer

AI agents can autonomously analyze network telemetry and decide on remediation actions.. B is correct because AI agents in closed-loop remediation workflows autonomously analyze network telemetry (e.g., gRPC, NETCONF) and decide on remediation actions without manual intervention, enabling rapid response. D is correct because tool-calling allows the AI agent to invoke external automation tools like Ansible or Python scripts to execute the chosen remediation steps. E is correct because a key part of the closed-loop is that the AI agent monitors the network after action to confirm the issue is resolved and adjusts if needed, ensuring the loop is closed. A is wrong because closed-loop automation implies autonomous execution based on predefined policies, not requiring manual approval for every action. C is wrong because AI agents use dynamic telemetry and learned patterns, not just static baseline configurations, to detect anomalies. F is wrong because AI agents augment, not eliminate, human oversight; human intervention remains for policy exceptions and oversight.

Answer

AI agents require manual approval before executing any remediation action in a closed-loop workflow.

Answer

AI agents rely solely on static baseline configurations to detect anomalies.

Answer

AI agents eliminate the need for human oversight in network operations.

Question 11

Drag and drop the AI/automation concepts on the left to the correct descriptions on the right.

Accepted Answer

Machine learning is a broad subset of AI. Deep learning uses multi-layer neural networks. NLP deals with human language. Computer Vision interprets visual data. Reinforcement learning uses rewards. Supervised learning uses labeled data.. AI Agent is correctly matched because it is defined as an autonomous entity that perceives its environment and takes actions to achieve goals. Tool-calling enables AI agents to invoke external functions or APIs, which aligns with the given description. Closed-loop remediation is accurately paired with the workflow that automatically detects, diagnoses, and corrects network issues without human intervention. Retrieval-Augmented Generation (RAG) is the technique that combines large language models with external knowledge retrieval to produce more accurate responses. Intent-based Networking (IBN) translates high-level business intent into network configuration and assurance, matching the description. Finally, Reinforcement Learning (RL) is the training method where an agent learns optimal actions through rewards and penalties, which perfectly fits its definition.

Answer

Machine learning uses multi-layer neural networks. Deep learning is a broad subset of AI. NLP interprets visual data. Computer Vision deals with human language. Reinforcement learning uses labeled data. Supervised learning uses rewards.

Answer

Machine learning uses rewards. Deep learning uses labeled data. NLP is a broad subset of AI. Computer Vision uses multi-layer neural networks. Reinforcement learning deals with human language. Supervised learning interprets visual data.

Answer

Machine learning interprets visual data. Deep learning deals with human language. NLP uses multi-layer neural networks. Computer Vision uses rewards. Reinforcement learning uses labeled data. Supervised learning is a broad subset of AI.

Question 12

A network administrator notices that the NTP server on Router R1 is not synchronizing with the upstream NTP server at 192.0.2.1. The router is configured as an NTP client, but show ntp status indicates the clock is unsynchronized and the stratum is 16. There is no firewall between R1 and 192.0.2.1. What is the most likely cause of this issue?

Accepted Answer

Router R1 does not have a route to reach 192.0.2.1.. The most likely cause is that Router R1 lacks a route to the upstream NTP server at 192.0.2.1. Without a valid IP route, NTP packets cannot reach the server, so the client remains unsynchronized with stratum 16. The other options are incorrect: A is not required for client operation, C is irrelevant because NTP version negotiation works across versions, and D is ruled out by the absence of a firewall.

Answer

The NTP server at 192.0.2.1 is not configured as a peer on R1.

Answer

The NTP server at 192.0.2.1 is not using NTP version 4.

Answer

The NTP server at 192.0.2.1 has a firewall blocking NTP traffic.

Question 13

A network engineer notices that the system clock on a Cisco IOS-XE router is incorrect, causing syslog timestamps to be unreliable. The router is configured as an NTP client to synchronize with a remote NTP server at 192.168.1.10. However, the show ntp status command indicates the clock is unsynchronized. What is the most likely cause of this issue?

Accepted Answer

The router cannot reach the NTP server due to a missing route or firewall blocking UDP port 123.. NTP operates over UDP port 123. If the router cannot reach the NTP server at 192.168.1.10 due to a missing route or a firewall blocking UDP 123, the NTP client will remain unsynchronized, as indicated by the 'show ntp status' command showing the clock as unsynchronized. This is the most common cause of NTP synchronization failure in a network.

Answer

The NTP server is using TCP instead of UDP for NTP communication.

Answer

The NTP server has a higher stratum level than the router's local clock, so the router ignores it.

Answer

NTP authentication is misconfigured on the router.

Question 14

Which TWO statements correctly describe NTP stratum levels and syslog severity levels in a Cisco IOS-XE environment?

Accepted Answer

An NTP stratum value of 1 indicates a higher accuracy than a stratum value of 3.. Option A is correct because a lower NTP stratum number indicates higher accuracy; stratum 1 is directly synchronized to a precise reference clock (e.g., GPS) and is thus more accurate than stratum 3, which is two hops away. Option C is correct because the 'ntp server' command configures a device to synchronize its clock to a specified NTP server, making it an NTP client. Option B is incorrect: syslog severity level 4 (warning) is more severe than level 5 (notice) because lower severity numbers indicate higher severity. Option D is incorrect: severity level 0 (emergency) is the most severe level, indicating a system-wide critical event, not a normal operational message. Option E is incorrect: NTP stratum 0 is assigned to an authoritative time source itself (e.g., atomic clock), not to devices directly connected to it; devices connected to stratum 0 sources are stratum 1.

Answer

A syslog severity level of 5 (notice) is more severe than a level of 4 (warning).

Answer

Syslog severity level 0 (emergency) indicates a normal operational message.

Answer

NTP stratum 0 is assigned to devices that are directly connected to an authoritative time source.

Question 15

Drag and drop the syslog severity levels and NTP concepts on the left to their correct descriptions on the right.

Accepted Answer

Syslog severity level 0 (Emergency) – System is unusable; NTP Stratum 0 – Reference clock (e.g., atomic clock). Syslog severity levels range from 0 (Emergency) to 7 (Debug), with 0 being the most critical. NTP stratum indicates clock accuracy: stratum 0 is the reference clock, stratum 1 is directly connected to a reference, and so on up to stratum 15, which is the maximum usable synchronized stratum. Stratum 16 means the device is unsynchronized. The ntp server command configures a device as a client, and show ntp status displays synchronization state and current stratum.

Answer

Syslog severity level 0 (Emergency) – System is unusable; NTP Stratum 0 – Client that synchronizes to a Stratum 1 server

Answer

Syslog severity level 7 (Debug) – System is unusable; NTP Stratum 0 – Reference clock (e.g., atomic clock)

Answer

Syslog severity level 7 (Debug) – System is unusable; NTP Stratum 0 – Client that synchronizes to a Stratum 1 server